Safe Omada MCP
Server Configuration
Describes the environment variables required to run the server.
| Name | Required | Description | Default |
|---|---|---|---|
| MCP_HTTP_PATH | No | MCP endpoint path for lab-only HTTP mode. | /mcp |
| MCP_HTTP_PORT | No | HTTP port for lab-only HTTP mode. | 3000 |
| OMADA_CA_FILE | No | PEM private CA bundle path; retains hostname verification. Mount the file read-only in Docker. | |
| OMADA_SITE_ID | No | Optional default site ID. When omitted and no tool-level site ID is supplied, a single available site is selected automatically; zero or multiple sites return an error. | |
| OMADA_TIMEOUT | No | HTTP timeout in milliseconds. | 30000 |
| OMADA_BASE_URL | Yes | Base URL of the Omada controller. | |
| OMADA_CLIENT_ID | Yes | OAuth client ID from Omada Platform Integration. | |
| OMADA_OMADAC_ID | Yes | Omada controller ID (omadacId). | |
| OMADA_STRICT_SSL | No | Enforce TLS certificate validation. | true |
| MCP_HTTP_BIND_ADDR | No | Loopback bind address only (127.0.0.1 or ::1). | 127.0.0.1 |
| OMADA_CATALOG_MODE | No | Catalog mode: standard tools or compact discovery/dispatch. | standard |
| MCP_HTTP_ALLOW_CORS | No | Enable CORS in lab-only HTTP mode. | true |
| MCP_SERVER_USE_HTTP | No | Legacy lab-only HTTP switch. HTTP starts only when both MCP_SERVER_USE_HTTP=true and MCP_UNSAFE_ENABLE_HTTP=true. | false |
| OMADA_CLIENT_SECRET | Yes | OAuth client secret. | |
| MCP_SERVER_LOG_LEVEL | No | Log level: debug, info, warn, or error. | info |
| MCP_SERVER_LOG_FORMAT | No | Log format: plain, json, or gcp-json. | plain |
| OMADA_TOOL_CATEGORIES | No | Explicit category override; replaces profile defaults. Recovery requires recovery:rw. | |
| MCP_HTTP_NGROK_ENABLED | No | Legacy placeholder; disabled in safe baseline. | false |
| MCP_UNSAFE_ENABLE_HTTP | No | Explicit acknowledgement required to enable the unsafe lab-only HTTP mode. | false |
| MCP_HTTP_ALLOWED_ORIGINS | No | Allowed origins for CORS in lab-only HTTP mode. | 127.0.0.1, localhost |
| OMADA_ALLOW_TOOL_HEADERS | No | Expose only bounded X-Request-ID / X-Correlation-ID headers. | false |
| OMADA_CAPABILITY_PROFILE | No | Built-in capability profile: safe-read, ops-write, admin, or compatibility. | safe-read |
| OMADA_INCLUDE_DEPRECATED | No | Include deprecated aliases. | false |
| MCP_HTTP_HEALTHCHECK_PATH | No | Health check path for lab-only HTTP mode. | /healthz |
| MCP_HTTP_NGROK_AUTH_TOKEN | No | Legacy placeholder for ngrok authentication token. | |
| MCP_HTTP_ENABLE_HEALTHCHECK | No | Enable health check in lab-only HTTP mode. | true |
Instructions
Guidance the server publishes about itself, which clients place ahead of the tool catalog so the model reads it before choosing anything.
This server publishes no instructions, or was last inspected before Glama recorded them.
Capabilities
Features and capabilities supported by this server
Protocol revision2025-11-25
| Capability | Details |
|---|---|
| tools | {
"listChanged": true
} |
| resources | {} |
Tools
Functions exposed to the LLM to take actions
| Name | Description |
|---|---|
| diagnoseCameraConnectivityA | Read-only camera network evidence by IP, hostname or MAC: current connection, VLAN/signal details and recent sessions. Does not test video decoding/inference or power-cycle a camera. |
| listDevicesA | List all provisioned (adopted) network devices in a site: gateways, switches, and access points. Returns MAC address, model, firmware version, IP, uptime, CPU/memory usage, and status for each device. Use MAC addresses from this response as input to getGatewayDetail, getSwitchDetail, getApDetail, etc. |
| listPendingDevicesA | List devices discovered on the network but not yet adopted into this site. Returns device type, MAC, IP, and model. These are devices waiting to be provisioned. |
| searchDevicesB | Search for devices globally across all sites the user has access to. Returns devices matching the search key. |
| listDevicesStatsA | Query statistics for global adopted devices with pagination and filtering. Supports fuzzy search by MAC address, name, model, or serial number, and filtering by tag or device series type (0: basic, 1: pro). |
| getAllDeviceBySiteA | Get all devices in a site including offline and disconnected devices. Unlike listDevices which may filter to active-only, this returns the full device inventory. Useful for auditing what hardware is registered to a site. |
| getFirmwareInfoA | Get the latest available firmware information for a device. Returns current firmware version, latest available version, and whether an upgrade is available. Use listDevices to get deviceMac values. |
| getGridAutoCheckUpgradeB | Get the auto-check upgrade plan list showing scheduled firmware upgrade checks across devices. Useful for auditing upgrade schedules and identifying devices due for automatic firmware updates. |
| getUplinkWiredDetailA | Get wired uplink detail for an access point. Returns the AP's Ethernet uplink port information including connected switch, port number, link speed, and PoE status. Useful for mapping physical network topology. |
| getDownlinkWiredDevicesA | Get wired downlink devices connected to an access point's LAN port. Returns a list of devices using the AP as a wired switch, including their MAC addresses and connection details. Useful for APs with built-in switch ports (e.g. EAP615-Wall). |
| getSpeedTestResultsA | Get the last speed test results for an access point. Returns upload/download throughput measurements from the most recent speed test. Use triggerSpeedTest first to initiate a new test; this returns stored results. |
| getFirmwareUpgradePlanC | Get the firmware upgrade plan list for devices managed by the controller. |
| getUpgradeLogsB | Get firmware upgrade logs showing the history of upgrade operations performed on devices. |
| getDeviceTagListC | Get the list of device tags defined in a site. |
| getUpgradeOverviewCriticalA | Get the number of critical firmware upgrades available across managed devices. |
| getUpgradeOverviewTryBetaC | Get the try-beta firmware switch status for the controller. |
| listUpgradeFirmwaresB | List uploaded firmware files available for manual upgrade. |
| listUpgradeOverviewFirmwaresC | List firmware pool entries in the upgrade overview. |
| listSitesStacksB | List switch stacks in a site. |
| getSitesDeviceWhiteListC | Get the device whitelist for a site. |
| getSwitchStackDetailC | Fetch detailed information for a specific switch stack. |
| getSwitchDetailA | Fetch full configuration and status for a specific switch: model, firmware, CPU/memory, all port states, PoE usage, VLAN config, and STP status. Use listDevices to get the switchMac. |
| getStackPortsC | Get all port information for a switch stack. |
| listSwitchNetworksA | List VLAN network assignments for a switch. Returns which VLANs are assigned to which ports, including tagged and untagged configurations. Use listDevices to get switchMac values. |
| getSwitchGeneralConfigA | Get general configuration for a switch including device name, LED settings, LLDP settings, flow control, and other global switch parameters. Use listDevices to get switchMac values. |
| getCableTestLogsA | Get cable test logs for a switch. Returns history of cable diagnostics including per-port test results, cable length estimates, and fault detection. Useful for diagnosing physical layer connectivity issues. |
| getCableTestFullResultsA | Get full cable test results for all ports on a switch. Returns detailed per-port diagnostic data including cable status (OK/open/short), estimated cable length, and fault location. More detailed than getCableTestLogs. |
| getOswStackLagListA | Get Link Aggregation Group (LAG) list for a switch stack. Returns configured LAG/trunk groups including member ports, load balancing mode, and status. Use getSwitchStackDetail to get the stackId. |
| getStackNetworkListA | Get the VLAN network list for a switch stack. Returns VLAN interface assignments across all stack members. Use getSwitchStackDetail to get the stackId. |
| getSwitchDot1xSettingB | Get the 802.1X switch port authentication setting. Controls port-based network access control on managed switches. |
| getSitesSwitchesEsC | Get easy managed switch info. |
| getSitesSwitchesEsGeneralConfigC | Get easy managed switch general config. |
| listSitesCableTestSwitchesPortsC | List ports available for cable test on a switch. |
| listSitesCableTestSwitchesIncrementResultsB | Get cable test incremental results for a switch. |
| getApDetailA | Fetch full configuration and status for a specific access point: model, firmware, CPU/memory, connected clients count, SSIDs, uptime, and mesh status. Use listDevices to get the apMac. |
| getApRadiosA | Get radio status for a specific access point: 2.4GHz and 5GHz band config, channel, TX power, channel utilization, and associated client count per radio. Use listDevices to get the apMac. |
| getApUplinkConfigA | Get the uplink configuration for an access point. Returns uplink mode (wired/wireless mesh), preferred uplink settings, and failover configuration. Useful for understanding mesh topology and wired uplink assignments. |
| getRadiosConfigA | Get per-radio configuration for an access point. Returns settings for each radio (2.4GHz, 5GHz, 6GHz) including band, channel, transmit power, channel width, and enabled SSIDs. Use getApRadios for runtime radio status; this returns configuration. |
| getApVlanConfigA | Get VLAN configuration for an access point. Returns the AP's management VLAN and per-SSID VLAN tagging settings. Useful for verifying network segmentation on wireless infrastructure. |
| getMeshStatisticsA | Get mesh link statistics for an access point. Returns wireless backhaul link quality, signal strength, throughput, and hop count for mesh-connected APs. Useful for diagnosing mesh network performance. |
| getApSnmpConfigA | Get SNMP configuration for an access point. Returns SNMP version, community strings, trap settings, and enabled state. Useful for auditing SNMP-based monitoring configurations on wireless infrastructure. |
| getApLldpConfigB | Get LLDP (Link Layer Discovery Protocol) configuration for an access point. Returns enabled state and advertised TLVs. LLDP allows network devices to advertise identity and capabilities to neighbours. |
| getApGeneralConfigA | Get general configuration for an access point. Returns device name, LED settings, country/region, management VLAN, bandwidth limits, and other global AP parameters. Use getApDetail for runtime status; this returns stored configuration. |
| getApQosConfigC | Get QoS configuration for a specific access point. |
| getApIpv6ConfigB | Get IPv6 configuration for a specific access point. |
| getSitesApsIpSettingC | Get IP settings for an AP. |
| getSitesApsChannelLimitC | Get channel limit config for an AP. |
| getSitesApsAvailableChannelB | Get available channels for an AP. |
| getSitesApsLoadBalanceC | Get load balance config for an AP. |
| getSitesApsOfdmaC | Get OFDMA configuration for an AP. |
| getSitesApsPowerSavingB | Get power saving config for an AP. |
| getSitesApsTrunkSettingC | Get trunk setting for an AP. |
| getSitesApsBridgeC | Get P2P bridge config for an AP. |
| listSitesApsPortsC | List ports on an AP. |
| getGatewayDetailA | Fetch full configuration and status for a specific gateway: model, firmware, CPU/memory, WAN/LAN ports, routing mode, and feature flags. Use listDevices to get the gatewayMac. |
| getGatewayWanStatusA | Get the WAN port status and connectivity information for a specific gateway. Returns WAN IP, DNS, uptime, link speed, TX/RX rates, and connection type for each WAN port. Use listDevices to find the gatewayMac. |
| getGatewayLanStatusA | Get LAN port status for a specific gateway: port link state, speed, duplex, connected device, and VLAN assignment. Use listDevices to get the gatewayMac. |
| getGatewayPortsA | Get all WAN and LAN port details for a specific gateway: link status, speed, IP address, bytes in/out, and port profile. More detailed than getGatewayWanStatus or getGatewayLanStatus. Use listDevices to get the gatewayMac. |
| getSitesGatewaysGeneralConfigC | Get gateway general config. |
| getSitesGatewaysPinB | Get PIN setting for a gateway (LTE model). |
| getSitesGatewaysSimCardUsedC | Get SIM card used by a gateway. |
| getSitesHealthGatewaysWansDetailsB | Get WAN port health details for a gateway. |
| listClientsA | List all network clients (wired and wireless) connected to a site. Returns client details including MAC address, IP, hostname, connected device, SSID (for wireless), signal strength, download/upload traffic, and online status. Use this to audit connected devices or find a specific client by name or MAC. |
| getClientDetailA | Get full detail for a specific client by MAC address, including connection info, IP, VLAN, signal strength, and traffic stats. |
| getGridKnownClientsA | Get historical known clients list (paginated). Returns clients that have previously connected to the site, with optional time range and search filtering. |
| getGridClientHistoryA | Get per-client connection history (paginated). Returns past connection sessions for a specific client including timestamps, SSID/network, traffic, and authentication type. |
| listMostActiveClientsA | Get the most active clients in a site, sorted by total traffic. Returns client name, MAC address, type, model, wireless status, and total traffic. This is a dashboard endpoint that provides a quick overview of top clients by traffic usage. |
| listClientsActivityA | Get client activity statistics over time from the dashboard. Returns time-series data showing new, active, and disconnected clients (both wireless/EAP and wired/switch) for each time snapshot. Useful for monitoring client connection trends and activity patterns. |
| listClientsPastConnectionsA | Get client past connection list with historical connection data. Returns information about clients that have previously connected to the network, including connection timestamps, traffic data, duration, and device details. Supports pagination, filtering by time range and guest status, sorting by last seen time, and fuzzy search by name/MAC/SSID. |
| getClientsDistributionA | Get client count distribution by connection type and band (wired, 2.4GHz, 5GHz, 6GHz). Useful for understanding the network composition at a glance. |
| getPastClientNumB | Get historical client count trend over a time range. Returns a time-series of client counts to show how connected devices changed over the specified period. Requires start and end as Unix epoch seconds. |
| getAclConfigTypeSettingB | Get the ACL configuration type setting for the site gateway (L2 or L3 mode). Determines how ACL rules are evaluated for traffic. |
| getOsgCustomAclListA | Get the custom gateway ACL rules list (paginated). Custom ACLs extend the standard gateway ACL rules with user-defined traffic policies. |
| getOswAclListA | Get the switch ACL list (paginated). Returns per-port or VLAN-based access control rules applied to managed switches. |
| getGridAllowListA | Get the IPS allow list (paginated). Returns entries that are explicitly allowed to bypass IPS inspection. Supports optional keyword search. |
| getGridBlockListA | Get the IPS block list (paginated). Returns entries that are explicitly blocked by the Intrusion Prevention System. Supports optional keyword search. |
| getGridGatewayRuleB | Get the URL filter gateway rules (paginated). Returns URL-based filtering rules applied to traffic through the gateway. |
| getGridEapRuleA | Get the URL filter AP rules (paginated). Returns URL-based filtering rules applied to wireless clients via access points. |
| getFirewallSettingB | Get the site-global firewall settings returned by the official Omada firewall endpoint. |
| listOsgAclsA | List gateway (OSG) ACL rules for a site: firewall rules controlling traffic between WAN, LAN, and guest networks. Returns rule name, action (allow/deny), source/destination, protocol, and enabled state. |
| listEapAclsA | List EAP (access point) ACL rules for a site: wireless client access control rules. Returns rule name, action (allow/deny), SSID scope, source/destination, protocol, and enabled state. |
| getDot1xConfigB | Get the 802.1X (dot1x) authentication configuration for a site, including enabled state, authentication mode, and RADIUS server settings. |
| getRadiusProxyConfigA | Get the global RADIUS proxy configuration from the controller, including proxy enabled state and server settings. |
| getUrlFilterGeneralA | Get the URL filter global setting, including whether URL filtering is enabled and the default action for unmatched requests. |
| getApplicationControlStatusB | Get application control (DPI) status and configuration for a site. |
| getAttackDefenseSettingB | Get the DDoS and attack defense configuration, including flood protection settings and thresholds. |
| getGatewayQosClassRulesB | Get the gateway QoS class rules for a site, including traffic classification rules and DSCP/priority markings. |
| getBandwidthCtrlDetailA | Get gateway bandwidth control detail settings for a site, including per-IP and per-SSID bandwidth limits. |
| getAppControlRulesA | Get application control rules for a site, listing application-level firewall rules that allow or block specific apps or app categories. |
| getAppControlCategoriesA | Get application control categories (families) for a site, listing available app category definitions used in application control rules. |
| getUrlFilterRulesB | Get gateway URL filter rules for a site (paginated), listing URL-based allow/block rules applied on the gateway. |
| getUrlFilterBlacklistA | Get the MAC-based deny (blacklist) filter entries for a site (paginated). Returns MAC addresses blocked from network access. |
| getUrlFilterWhitelistB | Get the MAC-based allow (whitelist) filter entries for a site (paginated). Returns MAC addresses explicitly allowed through MAC filtering. |
| getMacFilterDetailB | Get the MAC filtering global settings for a site, including whether MAC filtering is enabled and the default action for unmatched clients. |
| getQosPolicyB | Get the gateway QoS policy (tag outbound traffic settings) for a site, including DSCP marking rules for outbound traffic. |
| getTrafficPriorityA | Get the gateway VoIP and traffic prioritization settings for a site, including QoS prioritization rules for voice and real-time traffic. |
| getNetworkHealthSummaryA | Composite health snapshot — single call that combines dashboard overview (device/client counts, connectivity), internet/WAN status, client distribution, and recent active threats. Use this as the first call when checking if everything is working or when starting any troubleshooting session. Individual sections gracefully degrade if an endpoint is unavailable. |
| getGatewayHealthA | Composite gateway health check — single call that auto-discovers the site gateway then retrieves its full detail (CPU, memory, firmware, ports), WAN port statuses (link state, IP, ISP), and LAN interface statuses. Use when diagnosing internet connectivity issues, WAN failover, or gateway performance problems. Optionally accepts a gatewayMac to skip discovery. |
| diagnoseClientA | Composite client diagnostic — single call that combines a client's current connection status, detailed info (VLAN, signal, rate limit, group policy), and recent connection history (last 10 sessions). Use when troubleshooting why a device can't connect, has poor performance, or keeps disconnecting. Accepts MAC address, IP address, or hostname. |
| getDashboardWifiSummaryA | Get WiFi summary for a site dashboard: total APs, connected AP count, wireless client count, channel utilization per band (2.4GHz/5GHz), and SSID count. |
| getDashboardSwitchSummaryA | Get switch summary for a site dashboard: total switch count, total ports, active ports, PoE budget used vs available, and aggregate bandwidth. |
| getDashboardTrafficActivitiesA | Get traffic activity time-series data for a site, showing upload and download trends over time. |
| getDashboardPoEUsageA | Get PoE (Power over Ethernet) usage statistics for a site, showing power consumption per switch. |
| getDashboardTopCpuUsageB | Get the top devices by CPU usage for a site, useful for identifying overloaded devices. |
| getDashboardTopMemoryUsageB | Get the top devices by memory usage for a site, useful for identifying memory-constrained devices. |
| getDashboardMostActiveSwitchesB | Get the most active switches in a site, sorted by traffic volume. |
| getDashboardMostActiveEapsA | Get the most active access points (EAPs) in a site, sorted by traffic volume. |
| getDashboardOverviewA | Get the site overview topology: device counts (gateways, switches, APs), client counts (wired, wireless, guest), connectivity graph, and overall health status. Good first call to understand what's in the network. |
| getTrafficDistributionA | Get traffic distribution by protocol and application type over a time range. Shows breakdown of traffic by category (video, gaming, web, etc.) helping identify what is consuming bandwidth on the network. start and end are Unix timestamps in seconds. |
| getIspLoadA | Get per-WAN ISP link load over a time range. Shows traffic volume and utilization per internet uplink. Useful for understanding load balancing behaviour, identifying saturated WAN links, and analysing failover events. start and end are Unix timestamps in seconds. |
| searchOperationsA | Search only enabled, implemented Omada tools. Results do not expand permissions. Inspect a result with describeOperation. |
| describeOperationA | Get the exact argument schema and permission for an enabled tool. Unavailable tools cannot be inspected or executed. |
| getServerCapabilitiesA | Report this server version, effective catalog, profile and validation limits. Does not claim live controller compatibility. |
Prompts
Interactive templates invoked by user choice
| Name | Description |
|---|---|
No prompts | |
Resources
Contextual data attached and managed by the client
| Name | Description |
|---|---|
No resources | |
TDQS
Scored across 113 tools
Many tools have overlapping purposes: listDevices, getAllDeviceBySite, listDevicesStats, and searchDevices all return device inventories; getGatewayWanStatus, getGatewayLanStatus, and getGatewayPorts overlap heavily; cable-test tools and numerous AP config getters are hard to distinguish without reading full descriptions. Composite tools like getNetworkHealthSummary and getGatewayHealth help, but the set still presents multiple plausible choices for the same question.
All names are camelCase, but conventions vary: getApDetail vs getSitesApsIpSetting vs getGridClientHistory vs listSitesCableTestSwitchesPorts mix resource-first and path-derived naming. Verbs are mostly get/list/search/diagnose, though the same resource can be addressed through different prefixes, making the pattern only partially predictable.
113 tools is an extreme mismatch for a coherent MCP surface. The set is a broad mirror of controller endpoints rather than a curated set of operations, and many near-duplicate read endpoints make it difficult for an agent to choose correctly.
Coverage is heavily read-only: there are extensive getters for devices, clients, APs, switches, gateways, and firewall settings, but almost no create/update/delete operations for core lifecycle tasks such as adopting devices, upgrading firmware, configuring SSIDs, or editing ACLs. The searchOperations/describeOperation pair helps discovery but does not fill the missing mutation surface.